break-after@9999.0.0

Analysis

The package break-after@9999.0.0 is a dependency-confusion reconnaissance payload. It has a high version number (9999.0.0), a generic name, and an empty main module. On install, the preinstall hook runs callback.js which collects the hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GitHub, GitLab, Bitbucket, Travis, Drone, Buildkite, CircleCI, Jenkins identifiers) and sends them via HTTP GET to 75[.]119[.]137[.]232:31337/depconfuse. The URL path /depconfuse confirms dependency-confusion targeting. The collected metadata is used to identify CI environments that install the package, enabling follow-on attacks against those targets.